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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 
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Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 


The Act requires the Commissioner to take account of the development 
needs of children at different ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report 
Digital Childhood - addressing childhood development milestones in the 
Digital Environment as a starting point in this respect. This report draws 
upon a number of sources including findings of the United Kingdom 
Council for Child Internet Safety (UKCCIS) Evidence Group in its literature 


review of Children’s online activities risks and safety. 


The proposed age ranges are as follows: 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s 
personal data by providers of ISS (online services), how appropriate you 
consider the above age brackets would be (delete as appropriate): 


Very appropriate 


Q1A. Please provide any views or evidence on how appropriate you 
consider the above age brackets would be in setting design standards for 
the processing of children’s personal data by providers of ISS (online 
services), 


- The age brackets above seem appropriate, however, children’s needs are different, 
depending not only on age but their stage of development. This should be reflected in 
design standards as it is in education. 


Q2. Please provide any views or evidence you have on children’s 
development needs, in an online context in each or any of the above age 
brackets. 
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The United Nations Convention on the Rights of the Child 


The Data Protection Act 2018 requires the Commissioner to take account 
of the UK’s obligations under the UN Convention on the Rights of the Child 
when drafting the Code. 


Q3. Please provide any views or evidence you have on how the 
Convention might apply in the context of setting design standards for the 
processing of children’s personal data by providers of ISS (online 
services) 


Aspects of design 


The Government has provided the Commissioner with a list of areas which 
it proposes she should take into account when drafting the Code. 


These are as follows: 
e default privacy settings, 
e data minimisation standards, 
e the presentation and language of terms and conditions and privacy 
notices, 
e uses of geolocation technology, 
e automated and semi-automated profiling, 
e transparency of paid-for activity such as product placement and 
marketing, 
the sharing and resale of data, 
the strategies used to encourage extended user engagement, 
user reporting and resolution processes and systems, 
the ability to understand and activate a child’s right to erasure, 
rectification and restriction, 
e the ability to access advice from independent, specialist advocates 
on all data rights, and 
e any other aspect of design that the commissioner considers 
relevant. 


Q4. Please provide any views or evidence you think the Commissioner 
should take into account when explaining the meaning and coverage of 
these terms in the code. 
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- As members of the 5Rights coalition we support and endorse the 5Rights submission to this 
consultation, including their key recommendations for the code, summarised as follows: 

e The Code must offer a high bar of data privacy by default 

e Routine failure by an online service to adhere to its own published rules including; 
joining age, community rules, terms and conditions and privacy notices, should be 
considered a breach of the Code and therefore subject to the full extent of 
enforcement penalties under the GDPR. 

e Geolocation must be off by default. 

e Child Data Impact Assessments as standard for all existing services and products, 
and new services and products prior to launch. 

e The Code must introduce universal reporting standards (RRP), so that the criteria, 
systems and likely outcomes are familiar to children. 


e The Code requires a commitment from government to enforcement. 


- In addition, as the national body for personal, social, health and economic (PSHE) education 
we have a particular interest in ensuring that young people can access advice from 
independent, specialist advocates on all data rights — not least teachers providing PSHE 
education in the classroom. 

- PSHE is the logical vehicle on the school curriculum for educating children and young people 
about how to identify persuasive design and about how it impacts on personal data 
collection and use. The current diversity of approaches to designing services, and data 
sharing and collection practices, makes such education difficult. 

- Recent developments in the strengthening of ‘relationships and sex’ and ‘health’ education 
guidance cover a number of aspects relevant to data and privacy which are worth noting. 
‘Relationships and sex’ education forms part of broader PSHE education, and will be 
mandatory from 2020 in all secondary schools (‘relationships education’ will be mandatory 
in all primary schools). Accompanying draft guidance has been published by the Department 
for Education, open for consultation until 7 November 2018, and suggests that: 

o Para 54: “teachers should include content on information and data is shared and 
used online, for example sharing pictures, understanding that many websites are 
businesses and how sites may use information provided by others in ways they 
might not expect” 

o Para 76: “Pupils should have a strong understanding of how data is generated, 
collected, shared and used online, for example, how personal data is captured on 
social media or understanding the way that businesses may exploit the data 
available to them.” 

o Page 22: {pupils should know} “how information and data is generated, collected, 
shared and used online.” 

- The Age Appropriate Design Code could support this teaching both in terms of increasing 
consistency of service design and in forming the basis of clear and consistent expectations 
for young people about how data is generated, collected, shared and used online. 
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- Training should be available for all frontline professionals, including teachers and social 
workers, to ensure a broad understanding of the full range of opportunities and risks in the 
digital environment for children, including opportunities and risks within all the aspects of 
design covered by the Code. 

- Education should not however be used as an excuse for online service providers to avoid 
responsibility. To date education has had to react to problematic service design. Services 
should not only be designed to be age-appropriate, but should help to educate young users 
about safety and privacy features as part of their experience. 


Q5. Please provide any views or evidence you have on the following: 


Q5A. about the opportunities and challenges you think might arise in 
setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 


Q5C. about what design standards might be appropriate (ie where the bar 
should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 


Q5D. examples of ISS design you consider to be good practice. 


Q5E. about any additional areas, not included in the list above that you 
think should be the subject of a design standard. 
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Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 


Name PSHE Association 


Email info@pshe-association.org.uk 
Brief summary of what you think you could offer 


Information and experience on how data issues are currently covered in 
the PSHE curriculum and how the code could develop and support this. 


Further views and evidence 


Q7. Please provide any other views or evidence you have that you 
consider to be relevant to this call for evidence. 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 


A body representing the views or interests of parents? 
Please specify: 


A child development expert? 
Please specify: 


A provider of ISS likely to be accessed by children? 
Please specify: 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 


Other? 

Please specify: 

The PSHE Association is the national body for personal, 
social, health and economic education a membership 
association (and registered charity) for teachers and 
other practitioners delivering personal, social, health and 
economic (PSHE) education in schools. PSHE education is 
curriculum subject in English schools designed to support 
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children and young people’s health, safety and readiness 
for life - and work - beyond school. 


Thank you for responding to this call for evidence. 
We value your input. 
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